CVE-2026-45049

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `Cross-Domain Single Sign-On` (`CDSSO`) servlet allows a logged-in user's raw OpenAM session token to be POSTed to an attacker-controlled URL. An attacker who induces an authenticated victim to visit a crafted URL can receive the session credential and potentially hijack the session. Deployments must have `CDSSO` enabled, as is common in multi-domain deployments, and exploitation is additionally gated on a non-default configuration being absent. This issue is fixed in version 16.1.1.

• CWE-201

• https://github.com/OpenIdentityPlatform/OpenAM/commit/bda647f8540d8fb28aaaed716914692678c5a0a7
• https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1
• https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-r9pv-5rpp-vm8g

Published

Oct 29, 2026

Last Modified

Nov 4, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45043RustFS is a distributed object storage system built in Rust.…9.3
• CVE-2026-45044RustFS is a distributed object storage system built in Rust.…8.8
• CVE-2026-45045Fiber is an Express inspired web framework written in Go. Pr…5.3
• CVE-2026-45046Gryph provides a security layer for AI coding agents. Prior …5.5
• CVE-2026-45047bird-lg-go is a BIRD looking glass in Go. Prior to 1.4.5, th…7.5
• CVE-2026-45048Open Access Management (OpenAM) is an access management solu…8.5
• CVE-2026-4505A vulnerability has been found in eosphoros-ai DB-GPT up to …6.3
• CVE-2026-45051Open Access Management (OpenAM) is an access management solu…9.2
• CVE-2026-45052Open Access Management (OpenAM) is an access management solu…9.3
• CVE-2026-45053CubeCart is an ecommerce software solution. Prior to 6.7.0, …9.1
• CVE-2026-45054CubeCart is an ecommerce software solution. Prior to 6.7.0, …4.9
• CVE-2026-45055CubeCart is an ecommerce software solution. Prior to 6.7.2, …8.1